Is this where I use RegularExpression or Xml Tag Extract?
I am trying to create a search that shows when this value is 1 or zero on issuepolicy and gather the GUID in UI Event.
ideally an report that shows the GUID UIEvent and 0 or 1 from issuepolicy.
my RegEx works... Just not in splunk or with extracting the field 😞
and when I tried to extract the xml nothing seemed to notice the pipe
[search index=mainSvr customers | xmlkv issueNews ]